标签：#c

The breathalyzer identifies the amount of acetone in your breath to determine if your body is in ketosis.

TL;DR Croc GUI is a free desktop app for schollz/croc — encrypted peer-to-peer file transfer with drag-and-drop, QR codes (via getcroc.com ), and LAN mode. macOS, Windows, Linux. MIT licensed. Download: GitHub Releases Why I built this I send files with croc constantly. End-to-end encrypted, cross-platform, no vendor cloud. The CLI is perfect — until you're helping someone who doesn't have a terminal open. Croc GUI is the Send/Receive desktop app I wanted: same croc binary, clearer UX. What it does Send — drag files/folders, get a code phrase + QR link Receive — paste a code, pick a download folder Share — copy phrase, getcroc.com URL, or full croc … command Local-only — croc --local for LAN peers Zip — pack on send, unpack helper on receive Options — relay, port, proxy, overwrite, auto-confirm What it doesn't do Reimplement croc's crypto or protocol Upload anything to a GUI-specific cloud Claim to be an official schollz project Transfer engine: schollz/croc . Please sponsor schollz . Stack UI: React + TypeScript Shell: Tauri 2 (Rust) Engine: bundled croc binary per platform Dev quick start git clone https://github.com/interfluve-wav/croc-gui.git cd croc-gui/gui npm install npm run bundle:croc:download npm run tauri:dev Try it Platform Installer macOS (Apple Silicon) Croc_* (Apple Silicon).dmg macOS (Intel) Croc_*_x64.dmg Windows Croc_*_x64-setup.exe Linux .deb or .AppImage ⭐ Star on GitHub · 🐛 Issues

You built something. Tests pass. You're days from mainnet. Before you either skip security entirely (please don't) or spend weeks lining up a full audit, here's a self-check you can run in 20 minutes that catches the mistakes I see most often in first-time deployments. I run security reviews for small and new protocols, and the same handful of issues come up again and again. None of these need a tool — just your eyes and this list. 1. Who can call what? Open every external / public function that moves funds, mints, pauses, or upgrades. For each, ask: should a random address be able to call this? If not — is there an onlyOwner / onlyRole / require(msg.sender == ...) guarding it, in the function itself or in every internal function it calls? The classic bug isn't a missing modifier. It's a function that looks unguarded but delegates to a guarded internal one (fine), or one that looks guarded but the guard is in a branch a caller can skip (not fine). Trace the call, don't trust the signature. 2. The first-depositor trap (if you have a vault) If you mint shares from deposits (ERC-4626 or anything share-based), the first depositor can sometimes donate assets directly to the contract to inflate the share price, so the second depositor rounds down to zero shares and loses funds. Fix: virtual shares, a dead-shares mint at deploy, or a minimum-liquidity lock. OpenZeppelin's ERC-4626 handles this out of the box — a hand-rolled vault usually doesn't. 3. Reentrancy — but only the real kind Not every external call is reentrancy. It's a bug when an attacker-controlled call can re-enter and corrupt shared storage before you've updated it. Quick checks: Do you update state before the external transfer (checks-effects-interactions)? Is there a nonReentrant on functions that move value? Is the call target a trusted, immutable contract, or an arbitrary address the attacker supplies? A call to a protocol-owned contract, or a memory /local variable written after the call, is usually not

Claude Opus/Sonnet Voice Mode, Open-Weight Model Cost Savings, & GitHub AI Agent Security Today's Highlights This week's top stories focus on major commercial AI model updates, practical tools for cost-effective LLM deployment, and critical security vulnerabilities in AI-powered developer tools. Anthropic expands its multimodal voice capabilities to more powerful Claude models, while a new 'Show HN' project promises significant cost reductions with open-weight models. Claude’s voice mode is now available for Opus and Sonnet (The Verge AI) Source: https://www.theverge.com/ai-artificial-intelligence/970065/anthropic-voice-mode-claude-opus-sonnet-haiku-ai Anthropic has rolled out its voice mode capability to its more powerful Claude Opus and Sonnet models, extending a feature previously exclusive to the faster, lighter Haiku model. This enhancement allows developers to integrate advanced multimodal conversational AI into their applications, enabling real-time voice interactions with a higher degree of intelligence and nuance than previously possible. For instance, developers can now build voice agents that not only understand complex spoken queries but also provide sophisticated, context-aware responses, leveraging the deep reasoning and comprehensive knowledge base of Opus and Sonnet. This update significantly expands the potential for developers to create more natural and intuitive user experiences across various domains, from customer service and educational tools to interactive creative assistants. By making Opus and Sonnet accessible via voice, Anthropic is addressing a key demand for richer human-computer interaction, pushing the boundaries of what commercial AI APIs can offer in terms of multimodal capabilities. This move facilitates the creation of next-generation applications where seamless voice interaction is paramount, without sacrificing the underlying intelligence of the AI model. Comment: This is a huge step for building more capable voice-first applicat

Hi all, I've been on parental leave and while working on my garage door, I thought to myself... it would be great to open up this garage door from my phone without having to buy a bunch of expensive stuff. That snowballed into, I want the garage door buttons on my car's rear view mirror to trigger automations in home assistant. I went down a bit of a hardware rabbit hole and wrote a little writeup of my journey and a how-to. It's my first piece of public technical writing so I'm open to any feed

Many databases use B+tree indexes, but they all differ. It's a sorted structure. The leaf pages are logically sorted so that a specific key value belongs to one page. A lookup by value reaches a single leaf page and either directly finds an entry for that value or immediately knows there's no entry with that key. When a page becomes full, it is split into two pages, each covering its own dedicated range. To find the right page, an internal page holds the range of values for the pages below. This internal page can become full, and a new level is added above it. Finally, at the highest level, there's a single internal page that is the root. A lookup always starts at the root and goes down to the leaves, following the branches of internal pages. In a traditional B+tree lookup, the cost is proportional to the height of the tree because the search starts at the root and descends to a leaf: 1 page to read when all fits in one leaf that is also the root (0 levels of internal pages, total height is 1). With small keys, this level can typically index hundreds of rows. 2 pages to read when there's one root that can list all leaf pages (1 level of internal page, total height is 2). With small keys, this level can typically index tens or hundreds of thousands of rows. 3 pages to read when there's one level of branches under the root (so 2 levels of internal pages, total height is 3). With small keys, this level can typically index millions of rows. This means that finding one key within ten million rows may require traversing 3 index pages, where most of them are probably in cache given the small number of branches compared to the leaves. For a given index size, whatever the value you are looking for, it's always the same number of pages to read because the index is balanced (the commonly accepted meaning of the B in B+tree). This property is maintained because any page can split, but only splitting the root adds another level. I've described how the height of an index can incr

Ever chased a bug for days, only to discover the "bug" was actually the platform working exactly as designed? That happened to me building a client reporting pipeline. The lesson stuck. Here's what nobody tells you about pulling marketing data from multiple ad platforms: the hard part was never the dashboard. It was everything underneath it. The Setup That Looked Simple on Paper The brief sounded easy. Pull spend, clicks, and conversions from Google Ads and Meta. Store it. Display it in a chart. A junior dev could knock this out in a sprint, I figured. Reality disagreed. Google Ads API enforces operation quotas per developer token, and those quotas scale differently depending on account tier. Meanwhile, Meta's Marketing API throttles based on a rolling usage score tied to the ad account itself, not your app. Two platforms. Two completely different throttling philosophies. Neither documented in a way that made the actual limits obvious until you hit them in production. Where Things Actually Broke My first version polled every client account every hour. Fine for three clients. Then we onboarded client number twelve, and Meta started returning 429s intermittently. Not consistently — intermittently. That's the worst kind of bug. I initially assumed it was a code issue. Retry logic, maybe a race condition in my job scheduler. I spent three weeks going down that path. Eventually, I found the real cause: cumulative API call volume across all client accounts was tripping Meta's app-level rate limit, not the individual account limit. The fix wasn't more retries. It was a request queue with exponential backoff, plus a priority system so active dashboards refreshed before idle ones. Simple in hindsight. Expensive in dev hours. The Real Architecture Behind Multi-Platform Reporting If you're building this yourself, here's what a production-grade pipeline actually needs, based on what broke for me. A Queue, Not a Cron Job Don't just fire off API calls on a schedule and hope for t

I build products solo. Every single one of them sits on top of somebody else's API — Stripe for payments, OpenAI and Anthropic for AI features, Meta for ads, print-on-demand APIs, map APIs. My code is maybe half of what actually runs in production. The other half belongs to vendors, and it changes whenever they decide it changes. Twice this year the first notice I got about a breaking change was a production error. Not an email, not a warning. An error, and then me digging through the vendor's changelog trying to figure out what they changed and when. The information was public the whole time. It was sitting in a changelog page I never visit, because nobody visits changelog pages until something is on fire. So I'm building the thing I wanted to exist BreakWatch is simple: you tell it which APIs your product depends on, and it reads their public changelogs for you. It fetches each changelog page once a day Diffs it against yesterday's snapshot Classifies the real changes: breaking (endpoint removed, field deprecated, "migrate by September") vs. informational (new feature, docs clarification — stuff you can ignore) Alerts you only when something looks like it will break an existing integration Keeps everything in a searchable timeline, so six months later "what changed on their side right before this broke" takes ten seconds instead of an afternoon No SDK, no credentials, nothing installed in your codebase. It only reads public pages. What I tested this week I ran it against the real changelogs of the ten APIs I'm watching first: Stripe, Twilio, OpenAI, Anthropic, Shopify, GitHub, Slack, Cloudflare, Google Maps and Plaid. Some honest findings: 10/10 scrape cleanly now, but it took fixes. Stripe's changelog page alone is 3.3 MB. SendGrid's standalone changelog doesn't exist anymore (it merged into Twilio's). PayPal's developer site serves a JavaScript shell with an HTTP 404 to anything that isn't a full browser, so it's out until I add rendering. The thing I was most a

The bar we set We approved a plan on 2026-07-10 with an acceptance test we weren't sure was reachable. Six drafted analyst-memo queries against Nigerian economic data, scored 0-10 across five dimensions — named-entity density, citation quality, sector-specific detail, honest-gap acknowledgement, decision-usefulness. The strict pass criterion: every query's mean score across three temperature=0.2 runs must be ≥8/10, with no query below 6 in any single run. At approval time the aggregate was somewhere around 30/60 across the six queries — a system that produced grounded but generic answers, and refused competently but not always. The gap to the bar was real. We gave it 4-5 weeks. What we shipped Phase 1 — retrieval breadth. Kind-diversity enforcement across the top-K result set so a "start a fintech" query stopped collapsing into 12 CBN circulars and started pulling BOI, NEXIM, PayStack, Flutterwave, and the World Bank agribusiness chapters in the same context window. Named-entity boost when the query mentions "factory", "startup", "invest", "loan". Deduplication so a briefing about the same fact doesn't crowd out its own primary source. Phase 2 — a six-class rule-based intent classifier and memo templates. Sub-millisecond routing on regex patterns: venture\_feasibility\ , strategic\_forecasting\ , credit\_risk\ , regulatory\_analysis\ , market\_sizing\ , general\_qa\ . Each intent gets a memo template — a section-headed scaffold with a named-entity mandate, an honest-gaps section, and a 1000-1500 word target. The general\_qa\ template stays empty (no memo shape) so genuinely-general questions don't get forced into a memo they don't need. Phase 3 — composition quality. Two changes did most of the work here: 1. A CITATION PREFERENCE: PRIMARY OVER BRIEFING\ block in the system prompt. Primary sources — CBN circulars, NAICOM regulations, NBS reports, textbook chapters, IMF Article IV, press coverage of specific events — get cited over daily briefings when both are presen

When I set out to build a provably-fair random selection system on Solana, the obvious choice for randomness was a VRF (Verifiable Random Function). Instead, I built the system around Solana's SlotHashes sysvar with a commit-reveal scheme. Here's why, and what I gave up to get there. The problem A fair-selection system needs a winner (or set of winners) chosen in a way that's fair, and just as important that participants can check for themselves without taking anyone's word for it. VRF services (Switchboard, ORAO, etc.) solve the fairness part well: they produce randomness that's unpredictable in advance and cryptographically provable after the fact. But they come with a dependency on an oracle, a fee per request, and a proof that most users will never actually verify they'll trust it because the crypto math says they can, not because they did. I wanted something a participant with no crypto background could check in a browser console. The approach: commit-reveal with slot hashes The core idea: commit to the participant list before you know the randomness, then derive the randomness from a slot hash you couldn't have predicted at commit time. rust fn derive_randomness(target_hash: &[u8; 32], participant_root: &[u8; 32]) -> [u8; 32] { let mut combined_seed = [0u8; 64]; combined_seed[..32].copy_from_slice(target_hash); // slot hash at reveal combined_seed[32..].copy_from_slice(participant_root); // Merkle root, locked at commit solana_keccak_hasher::hash(&combined_seed).to_bytes() } The flow: Commit: participant list is finalized and hashed into a Merkle root; this is written on-chain. Wait: a target slot in the future is chosen as the reveal point. Reveal: once that slot passes, its hash is pulled from SlotHashes and combined with the committed root to derive the randomness. Select: the randomness deterministically picks winners from the participant set; winners get their own Merkle root and proofs. Every draw ends up with an audit record like: rust pub struct AuditR

NeurIPS E and D track review are out today and the average rating I received is a 3 and confidence is a 4. I can correct and address all their concerns. Do I still have a genuine shot of getting in or is it basically impossible at this point since none of my scores are a 4 or 5? Should I withdraw? submitted by /u/Ok-Ball-2546 [link] [留言]

I’ve been a NameCheap customer for 13 years. I’ve also helped out an old college club paying for a .com they use (that is registered to me under my name, address, and phone number). During a recent leadership transition, the incoming club lead wanted to make changes to the DNS and didn’t know to contact me. They figured out the domain name was parked at NameCheap, so they initiated a password reset using the domain name. I got a password reset email and immediately filed a NameCheap support tick